Obscura: VPN that can't log your activity

Posted by Flimm 7 hours ago

Comments

Comment by barathr 7 hours ago

As others have pointed out, this is like Apple iCloud Private Relay, and other multi-hop privacy systems that have been built on and off over the last several decades (Tor included).

We wrote a research paper on the general principle a few years ago: https://conferences.sigcomm.org/hotnets/2022/papers/hotnets2...

Comment by dang 3 hours ago

Discussed (just a bit) at the time:

The Decoupling Principle: A Practical Privacy Framework [pdf] - https://news.ycombinator.com/item?id=33897450 - Dec 2022 (3 comments)

Perhaps we should arrange a new thread about this?

Comment by dongcarl 6 hours ago

Good to see you here Barath :-)

I didn't realize Chris Wood was also an author!

Comment by maxloh 7 hours ago

I don't understand the point of this.

Many (if not all) of the benefits on the landing page are available in Mullvad too, which is a more mature and reputable product, has all clients fully open-source, and powers the exit servers for Obscura.

Why should I choose this over Mullvad?

Comment by maxloh 7 hours ago

Mullvad is a Swedish company, which has stricter privacy protection laws in place.

According to Obscura's legal page, it is a New York-based company [0]. Under US law, a secretive court order could compel a US company to update software or implement targeted logging on a specific user without notifying that user.

The only scenario where Obscura would be useful is if Mullvad were compromised. Why would I trust a New York company to shield me from a more reputable Swedish company?

[0]: "(2) your written notification must be mailed to 169 Madison Ave.; Ste. 11185 PMB 63183; New York, NY 10016..." https://obscura.com/legal/

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

I love folks who are also reasoning through security models! A few things to note here:

- We believe that all software running on a user's computer should be open source, so you can audit and build your own client: https://github.com/Sovereign-Engineering/obscuravpn-client

- With traditional Single-Party VPNs, even if you trust them fully and they're honest, they can still be compromised or hacked. With Obscura, even if we're hacked there's nothing to leak (other than WireGuard packets fully encrypted to Mullvad's servers).

- The change in trust is that instead of trusting a single company (Mullvad), you're trusting that not both Obscura AND Mullvad have been compromised, which is strictly less likely.

Comment by maxloh 5 hours ago

The "Obscura and Mullvad" argument actually makes sense. Having a company outside of EU jurisdiction makes it hard for both layers to be compromised at the same time.

Another question: How does the Obscura client get the Mullvad exit server’s public key? Are they hardcoded at compile time, fetched from Mullvad's server, or fetched from Obscura's server?

The latter seems to be dangerous if there isn't some kind of signature verification done on the client side before using the key.

Comment by dongcarl 3 hours ago

Good question! It's the latter right now (which is not ideal), but I think Mullvad is going to sign their server pubkeys pretty soon and we'll switch to that.

We do currently show it in the app and there's an easily clickable link so you can verify against Mullvad's website for the pubkey

Comment by miohtama 6 hours ago

The EU is working to make what Mullvad is doing illegal.

https://codamail.com/articles/privacy-law-directory/internat...

"EU surveillance co-operation"

Comment by autoexec 6 hours ago

Yeah, it's basically not possible to offer an actually secure and private service in the US. If men with guns and gag orders haven't shown up at their new york office yet, they will as soon as this VPN gets popular enough to show up on their radar. At that point if they have any integrity they'll shut their service down like Lababit did rather than allow it to be compromised by the state.

Comment by NordStreamYacht 1 hour ago

Sweden was compromised years ago, Assange's case is proof.

Comment by ignoramous 7 hours ago

I wouldn't be so sure; Ex A: The terrifying expansion of Sweden’s state surveillance, https://edri.org/our-work/the-terrifying-expansion-of-sweden...

Comment by dongcarl 6 hours ago

We think Mullvad is a great privacy tool, which is why we partnered with them!

As for what's different: We're a Multi-*Party* Relays (vs. traditional VPNs which are Single-Party Relays): https://www.privacyguides.org/articles/2024/11/17/where-are-...

With Multi-Party Relays you no longer have a trust a single entity not being malicious or compromised. More on this here: https://obscura.com/#how

Also, all our apps are open-source as well: https://github.com/Sovereign-Engineering/obscuravpn-client

Disclaimer: I'm the creator of Obscura.

Comment by frizlab 6 hours ago

How do you compare with iCloud Private Relay (with the obvious exception that private relay only works on macOS, and in specific apps only)?

Comment by dongcarl 6 hours ago

We're heavily inspired by them (see our original blog post which is a bit more technical here: https://obscura.com/blog/bootstrapping-trust/)

The differences are:

- We allow you to choose an exit location (I believe iCloud Private Relay restricts you to the same location)

- Our exit hop is Mullvad instead of Cloudflare+Fastly+Akamai

- We use QUIC for transport instead of HTTP/3 (which is built on QUIC and has a bit more overhead)

Comment by Barbing 6 hours ago

Same country at least - the iCloud Private Relay options, iOS:

“1: Maintain general location

2: Use country and time zone

Maintain your general location to receive localized content, or enhance your privacy by using a broader IP address based on your country and time zone.

Safari Private Browsing always uses an IP location from your country and time zone.”

Comment by bossyTeacher 6 hours ago

Because its CEO is known as the sponsor of the Orebro party?

1.5k comments discussion for context: https://news.ycombinator.com/item?id=48717469

Comment by omnimus 4 hours ago

That indeed can be a problem for many.

Comment by skyzoidbroczky 25 minutes ago

Any vpn company who market itself as aiming for the anonymity of its user is essentially selling snake oil to its customers. The fact that this company pretends to be more respective of the privacy of its user because it is in America is a vast joke, companies in America are expect to collaborate with the security services, even monopolies don't escape from it.

Comment by skaul 7 hours ago

So two hops, basically. First hop sees your IP address but not the website you're going to, second hop sees website but not IP address. Similar to Private Relay: https://support.apple.com/en-us/102602.

Comment by dongcarl 7 hours ago

(Carl from Obscura here)

Yup, exactly!

Comment by skaul 3 hours ago

Cool work. Can I ask: why not use MASQUE for this, instead of WireGuard-over-QUIC? Is it because it meant less changes on your partner's side?

Comment by mulmen 7 hours ago

But if both services keep logs de-anonymization is a join.

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

Very true, but if even 1 of (Obscura, Mullvad) is honest, there's no de-anonymization.

For traditional Single-Party VPNs, you just need to compromise 1 party, with Two-Party Relays, you need to compromise both.

Comment by 1 hour ago

Comment by PunchyHamster 6 hours ago

They don't even need to. If you observe enough of them you can correlate traffic patterns between them and find out which one is used by which endpoint

Comment by john_strinlai 7 hours ago

i am very skeptical of most vpn companies, and while i haven't looked too hard at obscura, it is worth noting the official partnership with mullvad (https://mullvad.net/en/blog/mullvad-partnered-with-obscura-v...) which is certainly a positive signal

side note: i really wish more companies did the no email + randomized account number flow. there is a certain popular "pro-privacy" product beloved by many here that requires an email address and refuses to offer a similar account number method, which has turned me off the product.

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

Yeah we thought the randomized account number flow was an ingenious idea, so we did that and made the last digit a Verhoeff checksum to check for mistypes!

Though sometimes people forget to write the number down and... There's not much we can do.

Comment by mulmen 7 hours ago

> there is a certain popular "pro-privacy" product beloved by many here

Please don’t speak in riddles. Just say what you mean.

Comment by john_strinlai 7 hours ago

for what purpose? there is nothing to be gained from pointing fingers, and takes the discussion in an even more unrelated direction.

although i guess people's curiosity is also dragging my comment in an unrelated direction anyways. lose-lose situation.

my main point is that the account number method is really nice, and a great selling point for such privacy-conscious products. not offering it in a privacy-conscious product is enough signal that it has made me choose not to purchase the product. that's the important bit, and where i was hoping to drive the conversation.

Comment by bityard 6 hours ago

There is even less to be gained by issuing vague unactionable warnings and/or accusations...

Comment by john_strinlai 6 hours ago

it's not a warning or accusation...

this isn't some hidden feature you get caught with your pants down over. if you try to sign up to something and it doesn't offer an account number, you know that it doesn't offer an account number instantly.

no time wasted for you. it's not some nefarious plot by the company.

it's just a business decision. i was hoping to talk about the business decision of that particular sign up flow.

Comment by PunchyHamster 6 hours ago

Incorrect. Pointing out bad products is a warning to other people to not waste time on it. We should be doing it more, not less.

I also have no idea what company/service you're talking about

Comment by mulmen 7 hours ago

Because it creates confusion as proven by the responses mistakenly assuming that you were referring to proton.

Comment by john_strinlai 6 hours ago

and if i mention the company, the responses are all about the company instead of the feature.

next time i will just keep my thoughts to myself and we'll all be happy.

Comment by mulmen 3 hours ago

You could have just ended your comment at:

> side note: i really wish more companies did the no email + randomized account number flow.

Everything you said after that added confusion and this tangent instead of the conversation you wanted to have.

Comment by 2 hours ago

Comment by mulmen 35 minutes ago

If you made that comment face to face I would assume you want me to ask what the company is. You could just not do that and talk about the signup flow instead. If you don’t want to talk about something don’t bring it up.

Comment by _bernd 4 hours ago

Yeap :/

Comment by t-writescode 6 hours ago

They’re almost certainly referencing Signal.

Comment by ignoramous 7 hours ago

> ... a certain popular "pro-privacy" product beloved by many here ...

If you're talking about Proton VPN, they do support "credential-less accounts" through their official apps, I believe? At least, on Android since 2024: https://www.androidpolice.com/proton-vpn-works-without-accou...

Comment by john_strinlai 7 hours ago

i am hesitant to really narrow it down, but it is not proton (i am a very early proton customer)

Comment by mulmen 7 hours ago

Then why comment at all? This is the danger of speaking in riddles.

Comment by 6 hours ago

Comment by baal80spam 7 hours ago

privacy <> anonymity

Proton VPN ensures privacy.

Comment by water-drummer 7 hours ago

Privacy without anonymity is just privacy with a backdoor waiting to be unlocked.

Comment by john_strinlai 7 hours ago

i am not talking about proton.

Comment by Wowfunhappy 55 minutes ago

> Exit servers (run by Mullvad) connect you to the internet but never see your personal info. Obscura masks your real IP address when relaying to the exit server.

How is this possible? If the exit server doesn't know your IP, how does it know where to send the traffic?

Comment by est 1 hour ago

I hope MPTCP would be more popular

Many src-dst connections but as a single logical connection. There's no way any middlebox could easy capture full data even metadata.

http2/QUIC can do something similar with frames (and hopefully multipath)

Don't place your whole stream inside a single src-dst IP connection. Demux them into many paths over the Internet. We need more variety of "traffic shapes" to combat Internet surveillance.

I'd argue it's even more effective than encryption. Split your activity and mix them, monitor traffic over a single transport is useless.

Comment by wahern 6 hours ago

> the first VPN that can’t log your activity and outsmarts internet censorship.

I guess they never heard of Zero Knowledge Systems: https://en.wikipedia.org/wiki/Zero_Knowledge_Systems

Comment by osnxkwmxkwnd 7 hours ago

This sounds pretty neat, and I do dig the website, though I can’t help but think it’s an odd combination to have bitmap/pixelated fonts and graphics inside perfect squircles.

Seems like you guys have two distinct ideas of a visual identity completely at odds there. Shape contrast is nice and can be rather fun to play with, but it has to be handled with care. Right now it feels like the designer had a bunch of ideas and didn’t know how to bring them together in a cohesive identity.

Bonus point for the TRON reference at the end! “I fight for the users!”

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

I'm a sucker for retro 8-bit graphics and fun mascots, so we went with that, but when we experimented with 8-bit for actual UI and long text we immediately found it to be super unusable and unreadable :-(

> Bonus point for the TRON reference at the end! “I fight for the users!”

Ah ofc the HN poster knows the reference :-) I've had it as my email signature since high school I think.

Comment by hehdtyjjoj 7 hours ago

How does this prove Obscura and Mullvad can't just both gather tracking data and then just combine it on demand?

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

This doesn't prove it. However, Obscura makes it so that there's no *single party* that if hacked or otherwise compromised would hurt your internet privacy.

Comment by woah 7 hours ago

and how is it better than just connecting to mullvad over nordvpn or something?

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

Other than the obvious hassle? XP

If you connect to Mullvad over NordVPN:

- You're giving both Mullvad and Nord some payment information (with Obscura you only give that to us, Mullvad has no idea)

- You don't get our QUIC-based obfuscation (see more here: https://obscura.com/blog/bootstrapping-trust/)

Comment by iAMkenough 7 hours ago

If you're already a Tailscale user, seems like this solution is nearly identical to using Mullvad as an exit node.

You would go with this solution if you don't trust Tailscale or NordVPN, I guess.

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

I could be wrong but in Tailscale if you use Mullvad as an exit node, the traffic flows directly from your device to Mullvad's servers.

Whereas with Obscura, your traffic flows to the Obscura relay, then the Mullvad exit.

Comment by iAMkenough 6 hours ago

Yes, but your tailnet IP is what is provided to Mullvad's servers. Not your public IP or personally identifiable information (according to Tailscale).

I'm under the impression that my personal device isn't the WireGuard endpoint for the Mullvad connection, Tailscale is.

Comment by dongcarl 5 hours ago

I believe if your device connects directly to Mullvad they will have your real IP (to know where to send reply packets)

Comment by hp197 6 hours ago

https://news.ycombinator.com/item?id=48696800

This is where part of your money flows to (I have opinions about this).

Not sure if you are also aware of it.

Comment by 41 minutes ago

Comment by ChocolateGod 7 hours ago

Your traffic is still unencrypted by the VPN provider at the other end of the Wireguard connection, I am not sure how this changes that?

Comment by fh67 5 hours ago

https://obscura.com/check/ does this page know the difference between a direct mullvad user and an obscura user, if so, how?

Packet padding but no docs about this?

Comment by dongcarl 6 hours ago

Carl from Obscura here

Happy to answer any questions y’all might have!

Also, the technical folks may be more interested in our original post: https://obscura.com/blog/bootstrapping-trust/

Comment by walrus01 6 hours ago

Hi Carl, thanks for being here to answer questions. Two questions: Do you have any active testers in Iran right now, and secondly, how is this architected to deal with advanced DPI boxes in ISP networks that detect flows of encrypted traffic and drop it? The methods I'm seeing people use with success from within Iran right now are very different than something like a commercial mullvad or competitor VPN.

Some of them rely on people having a helpful third party in ("free") country to set up a private relay in something like Azure IP space that isn't used by any other VPN users, so it doesn't attract a level of attention (or attention by multiples of different peoples' encrypted flows) that publicly published commercial VPN services do. It's a hard problem to solve on a scale of more than a couple of people.

The multi party relay concept is great, my concerns are more with traffic detection/DPI in between the end user and the first hop in the relay.

Comment by dongcarl 6 hours ago

Can't speak to Iran, but we use QUIC for transport (with an experimental TCP/TLS mode).

I believe QUIC has been harder to block for censors, esp with Chaos Protection on by default in Chrome. See: https://gfw.report/publications/usenixsecurity25/en/

Comment by floro 5 hours ago

Vp.net did it first: https://vp.net/l/en-US/technical#cryptography

Comment by mzajc 5 hours ago

Besides the website being complete slop, one very good reason to avoid this is that it's made by Andrew Lee (of Freenode hostile takeover fame).

Comment by abbracadabbra 4 hours ago

Great signup flow, except there’s an error when it comes to installing the app at the end. Worked around by installing manually via app store

Comment by ramblurr 7 hours ago

So like OHTTP but for UDP traffic? I suppose they are using MASQUE CONNECT-UDP?

They are careful to not exactly claim the same anonymity properties of Tor, though I think a lay reader will read that differently (ie, that they do have the same anonymity property as Tor).

That said being able to verify the inner wireguard conn to mullvad is nice. Of course you have to trust them that they aren't colluding with mullvad to share your identity/ip. But same goes for OHTTP.

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

Actually it's WireGuard over QUIC Unreliable Datagrams!

See: https://obscura.com/blog/bootstrapping-trust/

Comment by dorongrinstein 7 hours ago

I love the website, messaging and idea. Well done. if you guys need a place to host, please consider controlplane.com

Comment by VCFundedGenYer 5 hours ago

Many VPNs don't log activity. Headline is objectively false.

Comment by iAMkenough 7 hours ago

Basically a middle-man for a Mullvad VPN, where if Mullvad decides to pull out of their agreement with this company, you lose your connection and are hopefully refunded.

The single point of failure for this product is Mullvad and its leadership's changing opinions.

Comment by dgellow 7 hours ago

Obscura itself is also a point of failure

Comment by nalekberov 7 hours ago

I don't like 'us vs others' kinda comparisons, it's just marketing trick, which means they care more about sales than your privacy.

Secondly, Mullvad did what Obscura does now years ago.

Furthermore who needs a gamified VPN tool?

Comment by chews 6 hours ago

a vpn company is a paid for MITM attack surface.

Comment by dongcarl 6 hours ago

(Carl from Obscura here)

I totally agree for traditional Single-Party VPNs, which is why we are a Two-Party Relay. More here: https://obscura.com/blog/bootstrapping-trust/