Many (if not all) of the benefits on the landing page are available in Mullvad too, which is a more mature and reputable product, has all clients fully open-source, and powers the exit servers for Obscura.
Mullvad is a Swedish company, which has stricter privacy protection laws in place.
According to Obscura's legal page, it is a New York-based company [0]. Under US law, a secretive court order could theoretically compel a US company to update software or implement targeted logging on a specific user moving forward without notifying that user.
The only scenario where Obscura would be useful is if Mullvad were compromised. Why would I trust a New York company to shield me from a more reputable Swedish company?
[0]: "(2) your written notification must be mailed to 169 Madison Ave.; Ste. 11185 PMB 63183; New York, NY 10016..." https://obscura.com/legal/
side note: i really wish more companies did the no email + randomized account number flow. there is a certain popular "pro-privacy" product beloved by many here that requires an email address and refuses to offer a similar account number method, which has turned me off the product.
for what purpose? there is nothing to be gained from pointing fingers, and takes the discussion in an even more unrelated direction.
although i guess people's curiosity is also dragging my comment in an unrelated direction anyways. lose-lose situation.
my main point is that the account number method is really nice, and a great selling point for such privacy-conscious products. not offering it in a privacy-conscious product is enough signal that it has made me choose not to purchase the product. that's the important bit, and where i was hoping to drive the conversation.
this isn't some hidden feature you get caught with your pants down over. if you try to sign up to something and it doesn't offer an account number, you know that it doesn't offer an account number instantly.
no time wasted for you. it's not some nefarious plot by the company.
it's just a business decision. i was hoping to talk about the business decision of that particular sign up flow.
As others have pointed out, this is like Apple iCloud Private Relay, and other multi-hop privacy systems that have been built on and off over the last several decades (Tor included).
So two hops, basically. First hop sees your IP address but not the website you're going to, second hop sees website but not IP address. Similar to Private Relay: https://support.apple.com/en-us/102602.
They don't even need to. If you observe enough of them you can correlate traffic patterns between them and find out which one is used by which endpoint
This sounds pretty neat, and I do dig the website, though I can’t help but think it’s an odd combination to have bitmap/pixelated fonts and graphics inside perfect squircles.
Seems like you guys have two distinct ideas of a visual identity completely at odds there. Shape contrast is nice and can be rather fun to play with, but it has to be handled with care. Right now it feels like the designer had a bunch of ideas and didn’t know how to bring them together in a cohesive identity.
Bonus point for the TRON reference at the end! “I fight for the users!”
So like OHTTP but for UDP traffic? I suppose they are using MASQUE CONNECT-UDP?
They are careful to not exactly claim the same anonymity properties of Tor, though I think a lay reader will read that differently (ie, that they do have the same anonymity property as Tor).
That said being able to verify the inner wireguard conn to mullvad is nice. Of course you have to trust them that they aren't colluding with mullvad to share your identity/ip. But same goes for OHTTP.
Basically a middle-man for a Mullvad VPN, where if Mullvad decides to pull out of their agreement with this company, you lose your connection and are hopefully refunded.
The single point of failure for this product is Mullvad and its leadership's changing opinions.
Carl from Obscura here
Happy to answer any questions y’all might have!
I don't understand the point of this.
Many (if not all) of the benefits on the landing page are available in Mullvad too, which is a more mature and reputable product, has all clients fully open-source, and powers the exit servers for Obscura.
Why should I choose this over Mullvad?
We think Mullvad is a great privacy tool, which is why we partnered with them!
As for what's different: We're a Multi-*Party* Relays (vs. traditional VPNs which are Single-Party Relays): https://www.privacyguides.org/articles/2024/11/17/where-are-...
With Multi-Party Relays you no longer have a trust a single entity not being malicious or compromised. More on this here: https://obscura.com/#how
Also, all our apps are open-source as well: https://github.com/Sovereign-Engineering/obscuravpn-client
Disclaimer: I'm the creator of Obscura.
Mullvad is a Swedish company, which has stricter privacy protection laws in place.
According to Obscura's legal page, it is a New York-based company [0]. Under US law, a secretive court order could theoretically compel a US company to update software or implement targeted logging on a specific user moving forward without notifying that user.
The only scenario where Obscura would be useful is if Mullvad were compromised. Why would I trust a New York company to shield me from a more reputable Swedish company?
[0]: "(2) your written notification must be mailed to 169 Madison Ave.; Ste. 11185 PMB 63183; New York, NY 10016..." https://obscura.com/legal/
The EU is working to make what Mullvad is doing illegal.
https://codamail.com/articles/privacy-law-directory/internat...
"EU surveillance co-operation"
I wouldn't be so sure; Ex A: The terrifying expansion of Sweden’s state surveillance, https://edri.org/our-work/the-terrifying-expansion-of-sweden...
Because its CEO is known as the sponsor of the Orebro party?
1.5k comments discussion for context: https://news.ycombinator.com/item?id=48717469
i am very skeptical of most vpn companies, and while i haven't looked too hard at obscura, it is worth noting the official partnership with mullvad (https://mullvad.net/en/blog/mullvad-partnered-with-obscura-v...) which is certainly a positive signal
side note: i really wish more companies did the no email + randomized account number flow. there is a certain popular "pro-privacy" product beloved by many here that requires an email address and refuses to offer a similar account number method, which has turned me off the product.
> there is a certain popular "pro-privacy" product beloved by many here
Please don’t speak in riddles. Just say what you mean.
for what purpose? there is nothing to be gained from pointing fingers, and takes the discussion in an even more unrelated direction.
although i guess people's curiosity is also dragging my comment in an unrelated direction anyways. lose-lose situation.
my main point is that the account number method is really nice, and a great selling point for such privacy-conscious products. not offering it in a privacy-conscious product is enough signal that it has made me choose not to purchase the product. that's the important bit, and where i was hoping to drive the conversation.
There is even less to be gained by issuing vague unactionable warnings and/or accusations...
it's not a warning or accusation...
this isn't some hidden feature you get caught with your pants down over. if you try to sign up to something and it doesn't offer an account number, you know that it doesn't offer an account number instantly.
no time wasted for you. it's not some nefarious plot by the company.
it's just a business decision. i was hoping to talk about the business decision of that particular sign up flow.
Incorrect. Pointing out bad products is a warning to other people to not waste time on it. We should be doing it more, not less.
I also have no idea what company/service you're talking about
Because it creates confusion as proven by the responses mistakenly assuming that you were referring to proton.
and if i mention the company, the responses are all about the company instead of the feature.
next time i will just keep my thoughts to myself and we'll all be happy.
They’re almost certainly referencing Signal.
privacy <> anonymity
Proton VPN ensures privacy.
Privacy without anonymity is just privacy with a backdoor waiting to be unlocked.
i am not talking about proton.
> ... a certain popular "pro-privacy" product beloved by many here ...
If you're talking about Proton VPN, they do support "credential-less accounts" through their official apps, I believe? At least, on Android since 2024: https://www.androidpolice.com/proton-vpn-works-without-accou...
i am hesitant to really narrow it down, but it is not proton (i am a very early proton customer)
Then why comment at all? This is the danger of speaking in riddles.
As others have pointed out, this is like Apple iCloud Private Relay, and other multi-hop privacy systems that have been built on and off over the last several decades (Tor included).
We wrote a research paper on the general principle a few years ago: https://conferences.sigcomm.org/hotnets/2022/papers/hotnets2...
Good to see you here Barath :-)
I didn't realize Chris Wood was also an author!
So two hops, basically. First hop sees your IP address but not the website you're going to, second hop sees website but not IP address. Similar to Private Relay: https://support.apple.com/en-us/102602.
Yup, exactly!
But if both services keep logs de-anonymization is a join.
They don't even need to. If you observe enough of them you can correlate traffic patterns between them and find out which one is used by which endpoint
> the first VPN that can’t log your activity and outsmarts internet censorship.
I guess they never heard of Zero Knowledge Systems: https://en.wikipedia.org/wiki/Zero_Knowledge_Systems
https://news.ycombinator.com/item?id=48696800
This is where part of your money flows to...
How does this prove Obscura and Mullvad can't just both gather tracking data and then just combine it on demand?
and how is it better than just connecting to mullvad over nordvpn or something?
If you're already a Tailscale user, seems like this solution is nearly identical to using Mullvad as an exit node.
You would go with this solution if you don't trust Tailscale or NordVPN, I guess.
Your traffic is still unencrypted by the VPN provider at the other end of the Wireguard connection, I am not sure how this changes that?
This sounds pretty neat, and I do dig the website, though I can’t help but think it’s an odd combination to have bitmap/pixelated fonts and graphics inside perfect squircles.
Seems like you guys have two distinct ideas of a visual identity completely at odds there. Shape contrast is nice and can be rather fun to play with, but it has to be handled with care. Right now it feels like the designer had a bunch of ideas and didn’t know how to bring them together in a cohesive identity.
Bonus point for the TRON reference at the end! “I fight for the users!”
So like OHTTP but for UDP traffic? I suppose they are using MASQUE CONNECT-UDP?
They are careful to not exactly claim the same anonymity properties of Tor, though I think a lay reader will read that differently (ie, that they do have the same anonymity property as Tor).
That said being able to verify the inner wireguard conn to mullvad is nice. Of course you have to trust them that they aren't colluding with mullvad to share your identity/ip. But same goes for OHTTP.
I love the website, messaging and idea. Well done. if you guys need a place to host, please consider controlplane.com
Basically a middle-man for a Mullvad VPN, where if Mullvad decides to pull out of their agreement with this company, you lose your connection and are hopefully refunded.
The single point of failure for this product is Mullvad and its leadership's changing opinions.
Obscura itself is also a point of failure
I don't like 'us vs others' kinda comparisons, it's just marketing trick, which means they care more about sales than your privacy.
Secondly, Mullvad did what Obscura does now years ago.
Furthermore who needs a gamified VPN tool?
a vpn company is a paid for MITM attack surface.
> first
Really? XD
It’s often ‘impossible’ and until it happens /s