So I saw a post about Obscura VPN and went to do a deep dive and some reasearch on it. Then I came back to comment and the post was gone!

So, anyway, I wanted to share what I found since it actually is quite interesting and there are a few red flags.

Obscura is owned by Sovereign Engineering Inc. registered in the United States. Willingly chose to register the company in the US for some reason. This is a major issue due to the US being one of the few places in Five Eyes, and being able to issue log mandates and gag orders without allowing a company to get a lawyer and fight it.

The founder, Carl Dong, talks in multiple interviews about how his inspiration was the Chinese Great Firewall: https://www.truefans.fm/bit-buy-bit/6a980688566a94f95bc291b1?tab=transcript
https://noderunners.network/en/media/podcasts/hell-money/bitcoin-core-dev-walks-away-to-battle-the-great-firewall-of-china-with-carl-dong/187302

They also take VC Investor money:

Yes, we do have VC investors.

This may be a concern when choosing between “Traditional VPN” providers (Single-Party Relays) since you need to trust them wholly.

However, I believe this is much less of a concern with Multi-Party Relays like Obscura since a MPR provider will never have both your personal info and your traffic.

Additionally, it is much easier to switch between VPN providers than it is to switch between “cloud drive” providers (for example) since VPN providers don’t store anything you’d need to transfer.

Source: https://discuss.privacyguides.net/t/mullvad-has-partnered-with-obscura-vpn/24860/175

And when asked who the investors were:

We specifically chose investors who’d be strongly supportive of our stance on Privacy and Digital Freedom, so I’m not sure they’d appreciate us listing their names on a public forum :sweat_smile:

Source: https://discuss.privacyguides.net/t/mullvad-has-partnered-with-obscura-vpn/24860/179

He refuses to answer.

I hope this info on them helps anyone who might have been considering them make their decision in a more informed manner.

I stopped reading at Carl Dong 😂
...
No, I read it all, thanks for good info!

I commented that it was stupid in the previous thread. Someone asked “how so?” But the post got deleted. So here goes.

None of what the op says is information you need to know to understand that it’s stupid. They self describe as a layer between you and mullvad. Your computer first makes a connection to them then to mullvad before going on about its business.

That’s stupid.

If you trust mullvad (and all evidence suggests you should) then what do you need obscura for? It’s another layer of complexity and another series of points of failure to accomplish what, protection from mullvad? If you need to be protected from mullvad (and all evidence suggests you don’t) then you should just not use mullvad at all.

What likely happened is after a bunch of easily spooked people who havent carefully thought about their decisions jumped ship to other providers, this company approached mullvad to use their backend at wholesale rates to provide the service to the company’s customers for retail rates.

Just use mullvad instead of this shell game.

Agreed if you read through the forum posts of the founder a lot of it is him bending over backwards to justify this very thing. But I figured most people wouldn't be as convinced by the technical aspect, and I'm not qualified enough on it to like fully break it down myself either so just didn't speak on it.

I do think that it seems a bit worse than just an extra layer tho. It is literally moving your actual Identifying data (payment info and IP) into the hands of a US based company and out of the hands of Mullvad. It is protecting you from Mullvad, and exposing you to the massive fucking Five Eyes surveillance state, and US jurisdiction which is one of the most draconian in the world in regards to digital privacy.

Is this just a money grab? Maybe. Does the founder believe in what he's doing? Maybe. But does this also look exactly like what I would expect a US Government backed Honey Pot service to look like? Yes.

Also, if you don't trust Mullvad, use TOR.

Thanks for taking the time to research this a bit more. That post yesterday seemed odd, but you've provided some important context.

I sure as hell ain't trusting any service billing itself as "privacy focused" thats based in the United States.

I don’t think it’s a honeypot, it seems much more like a way to take money from people who believe there will be a vpn ban enforced by preventing Americans from either connecting to known foreign vpn services inside the nations borders or outside.

That would be a reasonable use case, in the case of a crackdown or ban this service would act as a completely law abiding relay out to mullvad. Great firewall style service.

E: and if using a combination of multiple hops between vpn servers and extra traffic shaping to confuse edge routers is your bag you can just use mullvads daita and multi hop and get that.

The way I understand this is that your data is e2e with the mullvad key, meaning Obscura can't see what you're browsing. All it can know is who you are (because of your IP address). Mullvad is the one who sees what you browse (if they were to log) but doesn't know who you are because the traffic comes from Obscura's server. That's the difference between Obscura's VPN and going straight with any other VPN where they can log your IP along with your browsing.

Imo, that extra anonymity and speed loss are not worth the extra expense, but it really depends on your threat model.

If it weren't in a US jurisdiction this would matter to me, but since it is it's irrelevant. US law basically makes privacy on any server within the US an illusion. Because they can issue a gag and log order to the server operator and you'd never know as they'd be legally barred from speaking on it.