cmc/cleberg.net

  1#+date:        [2025-02-11 Tue 11:40:00]
  2#+title:       Obscura VPN: A Two-Party Protocol Review
  3#+description: A review of Obscura VPN and its two-party protocol with Mullvad.
  4#+slug:        obscura-vpn
  5#+filetags:    :security:
  6
  7#+begin_quote
  8This review is written at a high-level for users, not a technical deep-dive of
  9VPN technologies.
 10#+end_quote
 11
 12* What is Obscura?
 13
 14[[https://obscura.net/][Obscura]] is a new VPN offering that's [[https://mullvad.net/en/blog/mullvad-partnered-with-obscura-vpn][partnered with Mullvad]] to provide a unique
 15service: a VPN that "can't log your activity" due to the fact that it uses
 16Obscura servers for initial traffic routing and then passes off the traffic to
 17Mullvad's WireGuard servers as exit nodes.
 18
 19This two-party VPN protocol allows you to use Obscura to relay your traffic, but
 20they don't see your traffic. On the other hand, the exit nodes from Mullvad will
 21see where you're connecting but cannot tell who you are as your traffic will
 22come directly from Obscura servers with other users.
 23
 24* Privacy Features
 25
 26One of the things I look for when considering a VPN are privacy features
 27intended to benefit users. Here are the features I love about Obscura:
 28
 29- Two-party VPN protocol with Mullvad's servers
 30- No email required for sign-up
 31- No credit card required, crypto options available
 32- Open source [[https://github.com/Sovereign-Engineering/obscuravpn-client][repository]] is available
 33- [[http://ngmmbxlzfpptluh4tbdt57prk3zxmq4ztew7l2whmg7hkqaof2nzf7id.onion/][Tor website available]]
 34- Transparent display of the exit server's public key (see the Location page in
 35  the app) so you can verify with Mullvad that you're connect via a genuine
 36  Mullvad exit node using [[https://mullvad.net/en/servers][Mullvad's server listing]]
 37
 38* Initial Impressions
 39
 40** Available Platforms
 41
 42I am testing out Obscura on macOS, as that is the only available platform. This
 43is the biggest downside, as I would not want to support different VPNs on
 44different devices - if I'm using Obscura, I want to use it on all of my
 45platforms (macOS, iOS, and Ubuntu).
 46
 47However, the macOS app is incredibly easy to install via the =.dmg= file
 48available on Obscura's website. Upon first launch, you're presented with a login
 49option and can create an account now, if you have not done so already.
 50
 51** Payment
 52
 53Once created, the app will ask you to pay if you do not have a subscription. As
 54far as I can tell, there is no free tier available. In my opinion, this is a
 55good thing as I hesitate to understand how privacy-focused apps make money when
 56they offer free services to users.
 57
 58#+caption: Payment
 59#+attr_html: :alt Options to fund your Obscura account with credit card or lightning.
 60[[https://img.cleberg.net/blog/20250211-obscura-vpn/payment.webp]]
 61
 62** Connection
 63
 64Once you've enrolled in either a subscription or one-time payment, Obscura will
 65return you to the app and allow you to connect. You can choose a specific server
 66location or automatically connect.
 67
 68#+caption: Initial Connection
 69#+attr_html: :alt Obscura macOS app on the Connection screen.
 70[[https://img.cleberg.net/blog/20250211-obscura-vpn/connect.webp]]
 71
 72#+caption: Toolbar Utility
 73#+attr_html: :alt The Obscura VPN menu bar app on macOS shows connection status, bandwidth status, and options to debug or quit.
 74[[https://img.cleberg.net/blog/20250211-obscura-vpn/toolbar.webp]]
 75
 76** Speed
 77
 78The connection feels naturally smooth and I haven't experienced any disruptions
 79or lag in my (very short) time testing out the application. To confirm, I
 80checked a speed test while connected to a server location in my country.
 81
 82Speed test results:
 83
 84- 85.49 Mbps (Down)
 85- 217.75 Mbps (Up)
 86- 25 ms (Ping)
 87
 88** Mullvad Verification
 89
 90Lastly, I checked with Mullvad's verification tool (=mullvad.net/en/check=) to
 91verify Obscura's claims that Obscura sends your traffic through Mullvad's exit
 92nodes before connecting to your target.
 93
 94From the image below, we can see that Mullvad confirmed my traffic to be
 95connected through a Mullvad IP address.
 96
 97#+caption: Mullvad Check
 98#+attr_html: :alt The Mullvad connection check web page shows all "green" when on Obscura.
 99[[https://img.cleberg.net/blog/20250211-obscura-vpn/mullvad-check.webp]]
100
101* Final Thoughts
102
103Overall, I have found the app to be fast and user friendly. The privacy features
104are certainly compelling, but the platform has a ways to go before it can
105displace something like Mullvad in the privacy-focused portion of the VPN
106market.
107
108I wish Obscura offered the following features:
109
110- Available on more platforms
111- Specifics on how many devices will be allowed per account
112- More server locations, especially in countries with stronger data privacy laws
113- Options to pay with other crypto beside Bitcoin, such as Monero
114- Whitepapers or videos that walk through the technical details and show how
115  traffic can be verified to be encrypted and connecting through the various
116  expected nodes
117- Verifiable builds
118
119However, Obscura is a nice tool for now and I hope to see more information from
120the technical side to help more users gain comfort around the security and
121privacy of the tool.
122
123Used Obscura? Send me an email and let me know your thoughts!