this post was submitted on 18 Jan 2026
2 points (100.0% liked)

Applied Paranoia

58 readers
2 users here now

Discussions of Paranoia, how to apply it in a digital ecosystem (Security, Privacy, Tools, Applications, Questions)

Rules

  1. Be nice
  2. Stay on topic
  3. Don’t farm rage
  4. Be respectful of others

founded 6 months ago
MODERATORS
jet@hackertalks.com
2
Talk with Mr Dong on Obscura VPNs [Interview] (youtu.be)
submitted 5 days ago* (last edited 5 days ago) by jet@hackertalks.com to c/applied_paranoia@hackertalks.com
0 comments fedilink hide all child comments
 

This is a delightful talk on VPNs, tradeoffs, levels of paranoia, threat models, I enjoyed the application to everyday security.

You don't have to trust Obscura—you just have to trust that not both Obscura and Mullvad are compromised. Henry sat down with Carl, former Bitcoin Core developer and founder of Obscura VPN, to discuss how it's the first VPN that mathematically can't log your activity, what makes it censorship-resistant against networks like the Great Firewall, and what it really means to build privacy that's more than "a pinky promise."

Summerizer

Obscura VPN: censorship-resistant multi-hop design

What Obscura is for

  • Reliable VPN connectivity in restrictive networks; daily-use UX; reduced reliance on any single party.

Base architecture

  • Two-hop tunnel: client -> Obscura ingress -> Mullvad WireGuard egress; user traffic exits on Mullvad IP space.
  • Ingress uses QUIC/HTTP/3-style traffic shaping so blocking looks like blocking major web services.
  • Egress is standard WireGuard, so the last hop stays fast and widely audited.

Why QUIC fronting

  • WireGuard handshakes are fingerprintable; DPI can block or throttle them.
  • QUIC blends into common web traffic; the Great Firewall cost to block QUIC is high.
  • Obscura can fall back to a “compatibility mode” using a plain WireGuard first hop when needed.

MASQUE and iCloud Private Relay relationship

  • Apple’s iCloud Private Relay uses a similar two-hop relay idea with a second-party egress; Obscura generalizes the concept for arbitrary traffic.
  • MASQUE (CONNECT-UDP / HTTP Datagrams over HTTP/3) provides a standardized way to tunnel UDP inside HTTP/3; Obscura built this stack in Rust/Go.

Trust separation and key handling

  • Obscura cannot decrypt user packets after the QUIC layer because payloads are encrypted to Mullvad’s published WireGuard server keys.
  • Users can verify the active egress via Mullvad’s connection-check page; correlation is possible only if parties collude.

Privacy stance

  • “No logs” comes from architecture: ingress lacks plaintext visibility; egress is Mullvad; both sides are separated by design.

Client and platform support

  • Native apps focus on macOS/iOS; WireGuard configs exist for other platforms with the same multi-hop path.
  • Split tunneling is hard to do safely; per-URL routing can leak DNS/traffic patterns; work ongoing for safer patterns.

Comparisons

  • Tor and decentralized VPNs target stronger anonymity but have exit-node trust and performance limits; Obscura targets everyday throughput with censorship resistance.
  • OpenVPN is complex to audit; WireGuard’s smaller surface makes auditing more tractable.

Performance and operations

  • Front hop adds overhead but keeps connections stable under loss and censorship; bare-metal performance aimed near line speed.
  • Payment options include Lightning; Monero planned; Obscura pays Mullvad for egress capacity.

References

no comments (yet)
sorted by: hot top controversial new old
there doesn't seem to be anything here