[traceroute66]

> For example https://obscura.net

Obscura ....

"Terms and the relationship between you and Obscura shall be governed by the laws of the State of New York"

Yeah, erm.

Now more than ever, trusting a US jurisdiction VPN provider ? No thanks !

[fartfeatures]

> Now more than ever, trusting a US jurisdiction VPN provider ? No thanks !

The whole point of Obscura is you aren't trusting any single company. A Swedish company and an American company would need to collude to cause a problem. Unless you know something I don't?

[traceroute66]

> The whole point of Obscura is you aren't trusting any single company.

First, Mullvad's infrastructure has been independently audited.

Mullvad integrity has also tested as proven by a legal case where they were subject to a search warrant when someone was trying to claim copyright infringement.

As far as I can tell, Obscura has not had anywhere near the same scrutiny.

Second, obscura is the first hop is it not ?

Therefore it may well "only" relay the traffic to the exit node but it is still a relay and hence open to SIGINT analysis by the US.

I would have thought therefore using Mullvad's built-in multi-hop mode on their audited platform would be the wiser decision ?

Or Tor if you insist on multi-party ?

[fartfeatures]

Hence why Mullvad is being used as the exit point.

You have full e2ee between yourself and Mullvad but crucially Mullvad don't know who your IP. Five eyes are already doing SIGINT on behalf of both the US and the UK government before my connection even reaches Obscura so I lose nothing but potentially gain privacy.

How is it you think a single company (Mullvad) having access to my IP and what I am browsing is less secure than splitting it up amongst multiple providers one of which being Mullvad with that audited platform you talk about?

If I wanted Tor on top I'd layer it on top too but that would still be a single point of failure.

[traceroute66]

I see you are carefully skipping around the point ....

Where is Obscura's independent audit ? When has Obscura been tested to the same extent that Mullvad was during its court batttle ?

Answer it wasn't.

Therefore Mulvad Multi-Hop mode. Or Mullvad + Tor, if you insist. Is the safer choice.

And the US juristiction of Obscura is not something you can brush under the carpet like it somehow doesn't matter.

With Obscura you are just throwing your first-hop traffic against an unknown. And an unknown that is under US jurisdiction, and hence PATRIOT Act etc.

[fartfeatures]

It's open source which means I can trust having the app installed if I build from source (or I can just use Wireguard directly). I then know I'm directly connected to a Mullvad Wireguard node by checking the public key here: https://mullvad.net/en/servers

Other than Wireguard protocol being broken there is no way for Obscura to snoop presuming I check the public key. I'm not saying I trust Obscura, I'm saying with their model I don't need to trust them which is vastly superior. Nor do I need to trust Mullvad.

You keep hand waving around that Obscura are somehow untrustworthy but you have steadfastly refused to address the fact that their model does not require trust. If you trust Mullvad (which you are claiming to) please show an attack that would work to breach this model. You can't.

You would benefit from reading their FAQs and this blog post: https://obscura.net/blog/bootstrapping-trust/

https://github.com/Sovereign-Engineering/obscuravpn-client