Comment by dongcarl | Hacker News Reader

Comment by dongcarl | Hacker News Reader

Parent Full thread

(Carl from Obscura here)

I love folks who are also reasoning through security models! A few things to note here:

- We believe that all software running on a user's computer should be open source, so you can audit and build your own client: https://github.com/Sovereign-Engineering/obscuravpn-client

- With traditional Single-Party VPNs, even if you trust them fully and they're honest, they can still be compromised or hacked. With Obscura, even if we're hacked there's nothing to leak (other than WireGuard packets fully encrypted to Mullvad's servers).

- The change in trust is that instead of trusting a single company (Mullvad), you're trusting that not both Obscura AND Mullvad have been compromised, which is strictly less likely.

The "Obscura and Mullvad" argument actually makes sense. Having a company outside of EU jurisdiction makes it hard for both layers to be compromised at the same time.

Another question: How does the Obscura client get the Mullvad exit server’s public key? Are they hardcoded at compile time, fetched from Mullvad's server, or fetched from Obscura's server?

The latter seems to be dangerous if there isn't some kind of signature verification done on the client side before using the key.

Good question! It's the latter right now (which is not ideal), but I think Mullvad is going to sign their server pubkeys pretty soon and we'll switch to that.

We do currently show it in the app and there's an easily clickable link so you can verify against Mullvad's website for the pubkey

> Having a company outside of EU jurisdiction makes it hard for both layers to be compromised at the same time.

Its just very, very, very unfortunate that they chose the US for Obscura.

Of all the jurisdictions in the world you chose the one that has become exponentially untrustworthy in the eyes of non-US users ....

… as well as in the eyes of many of its own citizens.

Generating all of your responses with AI makes me 100% sure you are not to be trusted

Reply on news.ycombinator.com