So I saw a post about Obscura VPN and went to do a deep dive and some reasearch on it. Then I came back to comment and the post was gone!
So, anyway, I wanted to share what I found since it actually is quite interesting and there are a few red flags.
Obscura is owned by Sovereign Engineering Inc. registered in the United States. Willingly chose to register the company in the US for some reason. This is a major issue due to the US being one of the few places in Five Eyes, and being able to issue log mandates and gag orders without allowing a company to get a lawyer and fight it.
The founder, Carl Dong, talks in multiple interviews about how his inspiration was the Chinese Great Firewall: https://www.truefans.fm/bit-buy-bit/6a980688566a94f95bc291b1?tab=transcript https://noderunners.network/en/media/podcasts/hell-money/bitcoin-core-dev-walks-away-to-battle-the-great-firewall-of-china-with-carl-dong/187302
They also take VC Investor money:
Yes, we do have VC investors.
This may be a concern when choosing between “Traditional VPN” providers (Single-Party Relays) since you need to trust them wholly.
However, I believe this is much less of a concern with Multi-Party Relays like Obscura since a MPR provider will never have both your personal info and your traffic.
Additionally, it is much easier to switch between VPN providers than it is to switch between “cloud drive” providers (for example) since VPN providers don’t store anything you’d need to transfer.
Source: https://discuss.privacyguides.net/t/mullvad-has-partnered-with-obscura-vpn/24860/175
And when asked who the investors were:
We specifically chose investors who’d be strongly supportive of our stance on Privacy and Digital Freedom, so I’m not sure they’d appreciate us listing their names on a public forum :sweat_smile:
Source: https://discuss.privacyguides.net/t/mullvad-has-partnered-with-obscura-vpn/24860/179
He refuses to answer.
I hope this info on them helps anyone who might have been considering them make their decision in a more informed manner.
The way I understand this is that your data is e2e with the mullvad key, meaning Obscura can't see what you're browsing. All it can know is who you are (because of your IP address). Mullvad is the one who sees what you browse (if they were to log) but doesn't know who you are because the traffic comes from Obscura's server. That's the difference between Obscura's VPN and going straight with any other VPN where they can log your IP along with your browsing.
Imo, that extra anonymity and speed loss are not worth the extra expense, but it really depends on your threat model.
If it weren't in a US jurisdiction this would matter to me, but since it is it's irrelevant. US law basically makes privacy on any server within the US an illusion. Because they can issue a gag and log order to the server operator and you'd never know as they'd be legally barred from speaking on it.