dongcarl

(Carl from Obscura here)

Thanks for the shout-out Cider! :)

(Carl from Obscura here)

Yeah it'd be a cool addition to combat internet surveillance but in practicality it may have a lot of problems:

1. Deteriorated performance if it's across unequal links (3G vs. Fibre WiFi)

2. Many countries have single exits to the global internet so they'd be able to assemble everything there

3. The most important plaintext data is probably in the TLS SNI which usually sits in a single packet for TLS in HTTP/3

(Carl from Obscura here)

Basically:

Your device <-> Obscura Relay <-> Mullvad Exit <-> Internet

So the exit server knows the IP of the Obscura Relay, but never sees your device's IP, lmk if that's clear!

(Carl from Obscura here)

Yup! Mostly less changes on Mullvad's side. Also QUIC has less overhead than MASQUE by definition.

Good question! It's the latter right now (which is not ideal), but I think Mullvad is going to sign their server pubkeys pretty soon and we'll switch to that.

We do currently show it in the app and there's an easily clickable link so you can verify against Mullvad's website for the pubkey

I believe if your device connects directly to Mullvad they will have your real IP (to know where to send reply packets)

(Carl from Obscura here)

Very true, but if even 1 of (Obscura, Mullvad) is honest, there's no de-anonymization.

For traditional Single-Party VPNs, you just need to compromise 1 party, with Two-Party Relays, you need to compromise both.

(Carl from Obscura here)

I could be wrong but in Tailscale if you use Mullvad as an exit node, the traffic flows directly from your device to Mullvad's servers.

Whereas with Obscura, your traffic flows to the Obscura relay, then the Mullvad exit.

(Carl from Obscura here)

This doesn't prove it. However, Obscura makes it so that there's no *single party* that if hacked or otherwise compromised would hurt your internet privacy.