Obscura: The first VPN that can't log your activity

Re:Obscura: The first VPN that can't log your activity by skaul on Tuesday September 22, 2026 @04:16PM (#49807483)

So two hops, basically. First hop sees your IP address but not the website you're going to, second hop sees website but not IP address. Similar to Private Relay: https://support.apple.com/en-us/102602.

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by mulmen on Tuesday September 22, 2026 @04:26PM (#49807579)

But if both services keep logs de-anonymization is a join.

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by dongcarl on Tuesday September 22, 2026 @05:24PM (#49808315)

(Carl from Obscura here)

Very true, but if even 1 of (Obscura, Mullvad) is honest, there's no de-anonymization.

For traditional Single-Party VPNs, you just need to compromise 1 party, with Two-Party Relays, you need to compromise both.

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by ignoramous on Wednesday September 23, 2026 @03:45AM (#49812880)

> Very true, but if even 1 of (Obscura, Mullvad) is honest

Just Obscura's compromise is enough, as pointed out previously: https://news.ycombinator.com/item?id=43016574

Unless something has changed in Obscura's architecture, the interface with Mullvad is under Obscura's control, and thus it can compromise client's credentials. This is unlike iCloud Private Relay where the guarantees are cryptographic in nature and not merely based on promises.

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by PunchyHamster on Tuesday September 22, 2026 @04:43PM (#49807799)

They don't even need to. If you observe enough of them you can correlate traffic patterns between them and find out which one is used by which endpoint

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by dongcarl on Tuesday September 22, 2026 @04:37PM (#49807731)

(Carl from Obscura here)

Yup, exactly!

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by skaul on Tuesday September 22, 2026 @08:19PM (#49810025)

Cool work. Can I ask: why not use MASQUE for this, instead of WireGuard-over-QUIC? Is it because it meant less changes on your partner's side?

[ Parent | on HN ]

Re:Obscura: The first VPN that can't log your activity by dongcarl on Tuesday September 22, 2026 @11:42PM (#49811384)

(Carl from Obscura here)

Yup! Mostly less changes on Mullvad's side. Also QUIC has less overhead than MASQUE by definition.

[ Parent | on HN ]